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CLAIMS 



1. An information processing method for generating a 
hierarchical tree which is applied to processing for 
5 supplying cipher texts decryptable only by certain selected 
equipment except excluded (revoked) equipment, by applying 
a Broadcast Encryption scheme based on a hierarchical tree 
configuration, the information processing method 
characterized by comprising: 

10 a one-way tree generating step of generating a one-way 

tree in which node -corresponding values are set to respective 
nodes, the node-corresponding values being set such that a 
node -corresponding value NV a corresponding to each of the 
nodes constituting the hierarchical tree is calculable by 

15 application of a function f based on a node -corresponding 
value NV b and a node-added variable salt b set so as to 
correspond to at least one lower- rank node; 

a node key calculating step of calculating node keys NK 
corresponding to the respective nodes constituting the 

20 one-way tree, by application of a function He using the 

node -corresponding values NV corresponding to the respective 
nodes as inputs; and 

an information- for- supply determining step of 
selecting a minimum node -corresponding value and node-added 

25 variables required to calculate node -corresponding values 
included in a path from a receiver-corresponding node to a 
root as a highest-rank node, as information to be supplied 
to a receiver corresponding to a terminal node of the one-way 
tree . 

30 



2 . The information processing method according to Claim 1, 
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characterized in that: 

the one-way tree generating step generates the one-way 
tree having a setting in which a node -corresponding value for 
a higher-rank node is calculable by encrypting processing 
5 (forward computation) to which a Rabin cryptography based on 
a node-corresponding value for a lower-rank node is applied, 
and in which the node -corresponding value for the lower-rank 
node is calculable by decrypting processing (inverse 
computation) to which a Rabin cryptography based on the 
10 node -corresponding value for the higher-rank node is 
applied . 

3 . The information processing method according to Claim 1, 
characterized by further comprising: 
15 a cipher text generating step of generating cipher texts 

by executing encrypting processing by selectively applying 
the node keys set so as to correspond to the respective nodes 
of the hierarchical tree. 

20 4 . The information processing method according to Claim 1, 
characterized in that: 

the one-way tree generating step generates the one-way 
tree in which, in a hierarchical tree having a binary 

tree configuration with a number N of terminal nodes, 

25 node -corresponding values NVi (1 = 2, 3, 2N-1) for 

respective nodes 1 to which node numbers 1 are given from a 
higher-rank node in a breadth first order in the binary tree 
satisfy a relationship of the following expression 
[Math 1] 

so NV Ul2 i = (NV, 2 + H (/ || salt ,)) mod M 
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where M is a product of two large primes, and H is a 
mapping function for outputting an element of Z M . 



5. The information processing method according to Claim 4, 
5 characterized in that: 

the one-way tree generating step includes, in a 
hierarchical tree having a binary tree configuration with a 
number N of terminal nodes, using, as inputs, a number of 
leaves as the number of node terminals: N, and a size of a 
10 modulus M : | M | , 

a step 1: Determine two large primes of a size |m|/2, 
and calculate a product M thereof; 

a step 2 : Determine the mapping function for outputting 
an element of Z M : H; 
15 a step 3 : Randomly select a node -corresponding value NVi 

for a root node being a highest -rank node of the binary tree 

as a value such that NViGZ* M ; 

a step 4: Perform the following processing a, b while 
incrementing 1 by 1 from 2 to 2N-1 using 1 as a counter 
20 a. Find a minimum positive integer salti such 

that tmpi is a quadratic residue modulo M, in the following 
expression 

[Math 2] 

temp l = (NV \j /2 j — H (I \\ salt z )) mod M 

25 

b. Find tmpi 1/2 mod M, and determine any of four 
solutions as a node -corresponding value NVi for a node 1; and 
a step 5 : Output 

2N-1 | M | -bit numbers (node-corresponding values) : 

3 0 NVi, NV 2 , NV 2N -i, and 
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2N-2 numbers (node-added variables) : salt 2 , salt 3/ 
salt 2 N-i/ 

and set them as the node-corresponding values and the 
node-added variables for the respective nodes 1(1 = 1 through 
5 2N-1) of the binary tree. 

6 . The information processing method according to Claim 1, 
characterized in that: 

the node key calculating step is a step of calculating 
10 node keys NK by application of a function He using 

node -corresponding values NV corresponding to the respective 
nodes as inputs, wherein the function He is a hash function 
for mapping a node -corresponding value NV into data of a 
bitlength corresponding to a size of a node key. 

15 

7. The information processing method according to Claim 1, 
characterized in that: 

the one-way tree generating step generates the one-way 
tree in which, in a hierarchical tree having a binary 

20 tree configuration with a number N of terminal nodes, 

node -corresponding values NVi (1 = 2, 3, 2N-1) for 

respective nodes 1 to which node numbers 1 are given from a 
higher-rank node in a breadth first order in the binary tree 
satisfy a relationship of the following expression 
25 [Math 3] 

NV 1112] = ( NV I 2 ® H 1 (0) m ° d M 

where H is a function for mapping an input of any size 
into a size | M | of a product M of the said two large primes, 
and H saltl (1) represents a value obtained by applying the 
30 function H to 1 as many as salti times. 
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8. The information processing method according to Claim 7, 
characterized in that: 

the one-way tree generating step includes, in a 
5 hierarchical tree having a binary tree configuration with a 
number N of terminal nodes, using, as inputs, a number of 
leaves as the number of node terminals: N, a size of a modulus 
M: |m|, and a mapping function H with an |M|-bit output, 

a step 1: Determine two large primes of a size |m|/2, 
10 and calculate a product M thereof; 

a step 2 : Randomly select a node -corresponding value NVi 
for a root node being a highest -rank node of the binary tree 

as a value such that NVieZ* M ; 

a step 3: Perform the following processing a, b while 
15 incrementing 1 by 1 from 2 to 2N-1 using 1 as a counter 

a. Find a minimum positive integer salti such 
that tmpi is a quadratic residue modulo M, in the following 
expression 

[Math 4] 

20 temp l = (NV L//2j 0 H salt 1 (/)) mod M 

b. Find tmpi 1/2 mod M, and determine any of four 
solutions as a node -corresponding value NVi for a node 1; and 

a step 4 : Output 

2N-1 | M | -bit numbers (node-corresponding values) : 

2 5 NVi, NV 2 , NV 2N -i, and 

2N-2 numbers (node-added variables) : salt 2/ salt 3 , 

salt 2 N-i/ 

and set them as the node -corresponding values and the 
node-added variables for the respective nodes 1(1 = 1 through 
30 2N-1) of the binary tree. 
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9 . An information processing method for generating a 
hierarchical tree applied to processing for supplying cipher 
texts decryptable only by certain selected equipment, using 
5 a Broadcast Encryption scheme based on a hierarchical tree 
configuration, the information processing method 
characterized by comprising: 

a one-way tree generating step of generating a one-way 
tree in which node-corresponding values are set to respective 

10 nodes, the node -corresponding values being set such that a 
node -corresponding value NV a corresponding to each of the 
nodes constituting the hierarchical tree is calculable by 
application of a function f based on a node -corresponding 
value NV b and a node-added variable salt b set so as to 

15 correspond to at least one lower-rank node; 

an intermediate label generating step of generating 
intermediate labels which are intermediate labels (IL) set 
as values from which values of labels corresponding to some 
selected special subsets, among labels (LABEL) respectively 

20 corresponding to subsets set on the basis of a SD (Subset 
Difference) scheme to which the hierarchical tree is applied, 
are calculable by computational processing; 

a label generating step of generating the labels 
corresponding to the special subsets by computational 

25 processing based on the intermediate labels, and further 
generating labels not corresponding to the special subsets 
by a computation based on the generated labels; and 

a labels-for-supply determining step of determining 
labels for supply to a receiver corresponding to a terminal 

30 node of the hierarchical tree, and selecting 

the special subset-noncorresponding labels not 
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corresponding to the special subsets, and 

a node-corresponding value as a minimum 
intermediate label and node-added variables required to 
calculate a node -corresponding value for any node included 
5 in a path from a receiver-corresponding node to a root as a 
highest -rank node, as information for supply to the receiver 
corresponding to the terminal node of the one-way tree, and 
wherein the one-way tree generating step generates the 
one-way tree in which, in a hierarchical tree having a binary 
10 tree configuration with a number N of terminal nodes, 

node -corresponding values NVi (1 = 2, 3, 2N-1) for 

respective nodes 1 to which node numbers 1 are given from a 
higher-rank node of a binary tree in a breadth first order 
in the binary tree satisfy a relationship of the following 
15 expression 

[Math 5] 

NV iiii] = ( NV i 2 ® H sah ' (0) mod M 

where H is a function for mapping an input of any size 
into a size | M | of a product M of the said two large primes, 

2 0 and H saltl (1) represents a value obtained by applying the 

function H to 1 as many as salti times. 

10. The information processing method according to Claim 9, 
characterized in that: 
25 the one-way tree generating step includes, in the 

hierarchical tree having the binary tree configuration with 
the number N of terminal nodes, using, as inputs, a number 
of leaves as the number of node terminals: N, a size of a 
modulus M: |m|, and a mapping function H with an |M|-bit 

3 0 output, 
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a step 1: Determine two large primes of a size |m|/2, 
and calculate a product M thereof; 

a step 2 : Randomly select a node -corresponding value NVi 
for the root node being the highest -rank node of the binary 

5 tree as a value such that NVieZ* M ; 

a step 3: Perform the following processing a, b while 
incrementing 1 by 1 from 2 to 2N-1 using 1 as a counter 

a. Find a minimum positive integer salti such 
that tmpi is a quadratic residue modulo M, in the following 

10 expression 

[Math 6] 

temp j = (NV L//2j 0 H salt 1 (/)) mod M 

b. Find tmpi 1/2 mod M, and determine any of four 
solutions as a node-corresponding value NVi for a node 1; and 

15 a step 4 : Output 

2N-1 | M | -bit numbers (node-corresponding values) : 

NVi, NV 2 , NV 2N _;l, and 

2N-2 numbers (node-added variables) : salt 2/ salt 3 , 

salt 2 N-i/ 

20 and set them as the node -corresponding values and the 

node-added variables for the respective nodes 1(1 = 1 through 
2N-1) of the binary tree. 

11 . A decryption processing method for executing processing 
2 5 for decrypting cipher texts encrypted with node keys 
respectively corresponding to nodes constituting a 
hierarchical tree, by applying a Broadcast Encryption scheme 
based on a hierarchical tree configuration, the decryption 
processing method characterized by comprising: 
30 a cipher text selecting step of selecting a cipher text 
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to which a node key generable on the basis of a 

node -corresponding value NV and node-added variables salt 

held by a self apparatus, from the cipher texts; 

a node key calculating step of calculating the node key 
5 applied to the cipher text on the basis of the 

node -corresponding value NV and the node -added variables 
salt held by the self apparatus; and 

a decrypting step of executing processing for 
decrypting the cipher text on the basis of the calculated node 
10 key. 

12 . The decryption processing method according to Claim 11, 
characterized in that: 

the cipher text selecting step is a step of finding, in 
a hierarchical tree in which respective nodes are given node 
numbers in a breadth first order with a root as a highest-rank 
node of the hierarchical tree numbered 1, a node number 
coinciding with any node number included in nodes in a path 
from a receiver to the root, among node numbers for node keys 
used for encryption. 

13 . The decryption processing method according to Claim 11, 
characterized in that: 

the node key calculating step includes a step of 
25 calculating node-corresponding values in a path from a self 
node to a root being a highest -rank node, among 

node -corresponding values NV X (1 = 2, 3, 2N-1) for 

respective nodes 1 to which node numbers 1 are given from a 
higher-rank node in a breadth first order in a binary tree, 
30 on the basis of the node -corresponding value NV and the 
node-added variables salt held by the self apparatus, by 



15 
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applying the following expression 
[Math 7] 

NV li/2\ = ( NV i 2 + H ( / II salt ,)) mod M 

where M is a product of two large primes, and H is a 
mapping function for outputting an element of Z M . 

14 . The decryption processing method according to Claim 11, 
characterized in that: 

the node key calculating step includes a step of 
calculating on the basis of the node -corresponding value held 
by the self apparatus, or node -corresponding values in a path 
from a self node to a root being a highest-rank node, and 
further on the basis of the following expression 

NK = He (NV) 

where NK is a node key; NV is a node -corresponding value; 
and He is a mapping function. 

15. The decryption processing method according to Claim 11, 
characterized in that: 

the node key calculating step includes a step of 
calculating node-corresponding values in a path from a self 
node to a root being a highest -rank node, among 

node -corresponding values NVi (1 = 2, 3, 2N-1) for 

respective nodes 1 to which node numbers 1 are given from a 

higher-rank node in a breadth first order in a binary tree, 
on the basis of the node -corresponding value NV and the 
node-added variables salt held by the self apparatus, by 
applying the following expression 
[Math 8] 
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NV L//2J = ( NV i 2 ® H sab ' (O) mod M 

where H is a function for mapping an input of any size 
into a size | M | of a product M of the said two large primes, 
and H saltl (1) represents a value obtained by applying the 
5 function H to 1 as many as salti times. 

16 . A decryption processing method for executing processing 
for decrypting cipher texts encrypted with subset keys 
respectively corresponding to subsets set on the basis of a 

10 SD (Subset Difference) scheme which is a Broadcast Encryption 
scheme based on a hierarchical tree configuration, the 
decryption processing method characterized by comprising: 
a cipher text selecting step of selecting a cipher text 
generated by applying a subset key derivable by pseudo- random 

15 number generating processing based on a label held by a self 
apparatus, or a label calculable on the basis of a 
node-corresponding value NV as an intermediate label, and 
node-added variables salt held by the self apparatus, from 
the cipher texts; 

20 a label calculating step of calculating a label 

corresponding to a special subset by executing computational 
processing based on the node-corresponding value NV and the 
node-added variable salt, if the subset key to be applied to 
the cipher text is underivable by the pseudo-random number 

25 generating processing based on the label held; 

a step of generating the subset key by the pseudo- random 
number generating processing based on the label held or the 
label calculated; and 

a decrypting step of executing processing for 

3 0 decrypting the cipher text by applying the generated subset 
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key, and 

wherein the label calculating step includes a step of 
calculating node-corresponding values in a path from a self 
node to a root being a highest -rank node, among 

5 node -corresponding values NVi (1 = 2, 3, 2N-1) for 

respective nodes 1 to which node numbers 1 are given from a 
higher-rank node in a breadth first order in a binary tree, 
on the basis of the node-corresponding value NV and the 
node-added variables salt held by the self apparatus, by 
10 applying the following expression 

[Math 9] 

NV L//2J = ( NV i 2 @ H sah 1 (0) mod M 

where H is a function for mapping an input of any size 
into a size | M | of a product M of the said two large primes, 
15 and H saltl (1) represents a value obtained by applying the 
function H to 1 as many as salti times. 

17. An information processing apparatus for generating a 
hierarchical tree which is applied to processing for 

20 supplying cipher texts decryptable only by certain selected 
equipment except excluded (revoked) equipment, by applying 
a Broadcast Encryption scheme based on a hierarchical tree 
configuration, the information processing apparatus 
characterized by comprising: 

25 a one-way tree generating means for generating a one-way 

tree in which node-corresponding values are set to respective 
nodes, the node -corresponding values being set such that a 
node -corresponding value NV a corresponding to each of the 
nodes constituting the hierarchical tree is calculable by 

30 application of a function f based on a node-corresponding 
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value NV b and a node-added variable salt b set so as to 
correspond to at least one lower- rank node; 

a node key calculating means for calculating node keys 
NK corresponding to the respective nodes constituting the 
5 one-way tree, by application of a function He using the 
node -corresponding values NV corresponding to the nodes as 
inputs; and 

an information- for- supply determining means for 
selecting a minimum node -corresponding value and node-added 
10 variables required to calculate node -corresponding values 
included in a path from a receiver-corresponding node to a 
root as a highest-rank node, as information to be supplied 
to a receiver corresponding to a terminal node of the one-way 
tree . 

15 

18 . The information processing apparatus according to Claim 
17, characterized in that: 

the one-way tree generating means is configured to 
generate the one-way tree having a setting in which a 

20 node -corresponding value for a higher-rank node is 

calculable by encrypting processing (forward computation) to 
which a Rabin cryptography based on a node-corresponding 
value for a lower-rank node is applied, and in which the 
node -corresponding value for the lower-rank node is 

25 calculable by decrypting processing (inverse computation) to 
which a Rabin cryptography based on the node -corresponding 
value for the higher-rank node is applied. 



19 . The information processing apparatus according to Claim 
30 17, characterized by further comprising: 

a cipher text generating means for generating cipher 
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texts by executing encrypting processing by selectively 
applying the node keys set so as to correspond to the 
respective nodes of the hierarchical tree. 

5 20 . The information processing apparatus according to Claim 
17, characterized in that: 

the one-way tree generating means is configured to 
generate the one-way tree in which, in a hierarchical tree 
having a binary tree configuration with a number N of terminal 

10 nodes, node-corresponding values NVi (1 = 2, 3, 2N-1) for 
respective nodes 1 to which node numbers 1 are given from a 
higher-rank node in a breadth first order in the binary tree 
satisfy a relationship of the following expression 
[Math 10] 

is NV ltll} = (NV, 2 + H(l\\ salt ,)) mod M 

where M is a product of two large primes, and H is a 
mapping function for outputting an element of Z M . 

21 . The information processing apparatus according to Claim 
20 20, characterized in that: 

the one-way tree generating means is configured to 
execute processing for generating the one-way tree by 
executing, in a hierarchical tree having a binary tree 
configuration with a number N of terminal nodes, using, as 
25 inputs, a number of leaves as the number of node terminals: 
N, and a size of a modulus M : |m|, 

a step 1: Determine two large primes of a size |m|/2, 
and calculate a product M thereof; 

a step 2 : Determine the mapping function for outputting 
3 0 an element of Z M : H; 
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a step 3 : Randomly select a node-corresponding value NVi 
for a root node being a highest -rank node of the binary tree 

as a value such that NVieZ* M ; 

a step 4: Perform the following processing a, b while 
5 incrementing 1 by 1 from 2 to 2N-1 using 1 as a counter 

a. Find a minimum positive integer salti such 
that tmpi is a quadratic residue modulo M, in the following 
expression 

[Math 11] 

10 temp l — (NV y /2 j—H(l\\ salt z )) mod M 

b. Find tmpi 1/2 mod M, and determine any of four 
solutions as a node-corresponding value NVi for a node 1; and 

a step 5 : Output 

2N-1 | M | -bit numbers (node-corresponding values) : 

NVi, NV 2/ NVsn-!, and 

2N-2 numbers (node-added variables) : salt 2/ salt 3 , 

salt 2 N-i/ 

and set them as the node -corresponding values and the 
node-added variables for the respective nodes 1(1 = 1 through 
2N-1) of the binary tree. 

22 . The information processing apparatus according to Claim 
17, characterized in that: 
25 the node key calculating means is configured to 

calculate node keys NK by application of a function He using 
node -corresponding values NV corresponding to the respective 
nodes as inputs, wherein the function He is a hash function 
for mapping a node -corresponding value NV into data of a 
30 bitlength corresponding to a size of a node key. 
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23 . The information processing apparatus according to Claim 
17, characterized in that: 

the one-way tree generating means is configured to 
5 generate the one-way tree in which, in a hierarchical tree 
having a binary tree configuration with a number N of terminal 

nodes, node -corresponding values NVi (1 = 2, 3, 2N-1) for 
respective nodes 1 to which node numbers 1 are given from a 
higher-rank node in a breadth first order in the binary tree 
10 satisfy a relationship of the following expression 

[Math 12] 

NV L//2J = ( NV i 2 @ H sah 1 (0) mod M 

where H is a function for mapping an input of any size 
into a size | M | of a product M of the said two large primes, 
15 and H saltl (1) represents a value obtained by applying the 
function H to 1 as many as salti times. 

24 . The information processing apparatus according to Claim 
23, characterized in that: 

20 the one-way tree generating means is configured to 

generate the one-way tree by executing, in a hierarchical 
tree having a binary tree configuration with a number N of 
terminal nodes, using, as inputs, a number of leaves as the 
number of node terminals: N, a size of a modulus M: | M | , and 

25 a mapping function H with an |M|-bit output, 

a step 1: Determine two large primes of a size |m|/2, 
and calculate a product M thereof; 

a step 2 : Randomly select a node -corresponding value NVi 
for a root node being a highest -rank node of the binary tree 

3 0 as a value such that NVigZ* m ; 
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a step 3: Perform the following processing a, b while 
incrementing 1 by 1 from 2 to 2N-1 using 1 as a counter 

a. Find a minimum positive integer salti such 
that tmpi is a quadratic residue modulo M, in the following 

5 expression 

[Math 13] 

temp l = (NV L//2j 0 H salt 1 (/)) mod M 

b. Find tmpi 1/2 mod M, and determine any of four 
solutions as a node -corresponding value NVi for a node 1; and 

10 a step 4: Output 

2N-1 | M | -bit numbers (node-corresponding values) : 

NVi, NV 2 , NV 2N -i, and 

2N-2 numbers (node-added variables) : salt 2 , salt 3 , 

salt 2 N-i/ 

15 and set them as the node -corresponding values and the 

node-added variables for the respective nodes 1(1 = 1 through 
2N-1) of the binary tree. 



25. An information processing apparatus for generating a 
20 hierarchical tree applied to processing for supplying cipher 
texts decryptable only by certain selected equipment, using 
a Broadcast Encryption scheme based on a hierarchical tree 
configuration, the information processing apparatus 
characterized by comprising: 
25 a one-way tree generating means for generating a one-way 

tree in which node-corresponding values are set to respective 
nodes, the node -corresponding values being set such that a 
node -corresponding value NV a corresponding to each of the 
nodes constituting the hierarchical tree is calculable by 
30 application of a function f based on a node-corresponding 
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value NV b and a node-added variable salt b set so as to 
correspond to at least one lower- rank node; 

an intermediate label generating means for generating 
intermediate labels which are intermediate labels (IL) set 
5 as values from which values of labels corresponding to some 
selected special subsets, among labels (LABEL) respectively 
corresponding to subsets set on the basis of a SD (Subset 
Difference) scheme to which the hierarchical tree is applied, 
are calculable by computational processing; 

10 a label generating means for generating the labels 

corresponding to the special subsets by computational 
processing based on the intermediate labels, and further 
generating labels not corresponding to the special subsets 
by a computation based on the generated labels; and 

15 a labels- for- supply determining means for determining 

labels for supply to a receiver corresponding to a terminal 
node of the hierarchical tree, and selecting 

the special subset -noncorresponding labels not 
corresponding to the special subsets, and 

20 a node -corresponding value as a minimum 

intermediate label and node-added variables required to 
calculate a node -corresponding value for any node included 
in a path from a receiver-corresponding node to a root as a 
highest -rank node, as information for supply to the receiver 

2 5 corresponding to the terminal node of the one-way tree, and 

wherein the one-way tree generating means is configured 
to generate the one-way tree, in which in a hierarchical tree 
having a binary tree configuration with a number N of terminal 

nodes, node -corresponding values NVi (1=2, 3, ••, 2N-1) for 

3 0 respective nodes 1 to which node numbers 1 are given from a 

higher-rank node of a binary tree in a breadth first order 
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in the binary tree satisfy a relationship of the following 
expression 

[Math 14] 

NV lll2] = (NV * 0 H saltl (l)) mod M 

where H is a function for mapping an input of any size 
into a size | M | of a product M of the said two large primes, 
and H saltl (1) represents a value obtained by applying the 
function H to 1 as many as salti times. 



10 26 . The information processing apparatus according to Claim 

25, characterized in that: 

the one-way tree generating means is configured to 

generate the one-way tree by executing, in the hierarchical 

tree having the binary tree configuration with the number N 
15 of terminal nodes, using, as inputs, a number of leaves as 

the number of node terminals: N, a size of a modulus M: |m| , 

and a mapping function H with an |M|-bit output, 

a step 1: Determine two large primes of a size |m|/2, 

and calculate a product M thereof; 
20 a step 2 : Randomly select a node-corresponding value NVi 

for the root node being the highest -rank node of the binary 

tree as a value such that NVieZ* M ; 

a step 3: Perform the following processing a, b while 
incrementing 1 by 1 from 2 to 2N-1 using 1 as a counter 
25 a. Find a minimum positive integer salti such 

that tmpi is a quadratic residue modulo M, in the following 
expression 

[Math 15] 

temp j = (NV Lz/2 j 0 H salt 1 (/)) mod M 
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b. Find tmp^^ mod M, and determine any of four 
solutions as a node-corresponding value NVi for a node 1; and 
a step 4 : Output 

2N-1 | M | -bit numbers (node-corresponding values) : 

5 NVi, NV 2/ NV 2N -i, and 

2N-2 numbers (node-added variables) : salt 2/ salt 3 , 

••• , salt 2 N-i / 

and set them as the node -corresponding values and the 
node-added variables for the respective nodes 1(1 = 1 through 
10 2N-1) of the binary tree. 



27. A decryption processing apparatus for executing 
processing for decrypting cipher texts encrypted with node 
keys respectively corresponding to nodes constituting a 

15 hierarchical tree, by applying a Broadcast Encryption scheme 
based on a hierarchical tree configuration, the decryption 
processing apparatus characterized by comprising: 

a cipher text selecting means for selecting a cipher 
text to which a node key generable on the basis of 

20 node -corresponding values NV and node-added variables salt 
held by a self apparatus, from the cipher texts; 

a node key calculating means for calculating the node 
key applied to the cipher text on the basis of the 
node -corresponding value NV and the node -added variables 

25 salt held by the self apparatus; and 

a decrypting means for executing processing for 
decrypting the cipher text on the basis of the calculated node 
key . 



30 28. The decryption processing apparatus according to Claim 
27, characterized in that: 
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the cipher text selecting means is configured to find, 
in a hierarchical tree in which respective nodes are given 
node numbers in a breadth first order with a root as a 
highest -rank node of the hierarchical tree numbered 1, a node 
5 number coinciding with any node number included in nodes in 
a path from a receiver to the root, among node numbers for 
node keys used for encryption. 

29. The decryption processing apparatus according to Claim 
10 27, characterized in that 

the node key calculating means 

is configured to execute processing for calculating 
node -corresponding values in a path from a self node to 
a root being a highest -rank node, among node -corresponding 

15 values NVi (1 = 2, 3, 2N-1) for respective nodes 1 to which 
node numbers 1 are given from a higher- rank node in a breadth 

first order in a binary tree, on the basis of the 
node -corresponding value NV and the node -added variables 
salt held by the self apparatus, by applying the following 
20 expression 

[Math 16] 

NV L//2J = ( NV i 2 + H ( z II salt /)) mod M 

where M is a product of two large primes, and H is a 
mapping function for outputting an element of Z M . 

25 

30. The decryption processing apparatus according to Claim 
27, characterized in that 

the node key calculating means 

is configured to execute processing for calculating on 
30 the basis of the node-corresponding value held by the self 
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apparatus, or node -corresponding values in a path from a self 
node to a root being a highest -rank node, and further on the 
basis of the following expression 
NK = He (NV) 

5 where NK is a node key; NV is a node -corresponding value; 

and He is a mapping function. 

31. The decryption processing apparatus according to Claim 
11, characterized in that: 

10 the node key calculating means is configured to execute 

processing for calculating node -corresponding values in a 
path from a self node to a root being a highest-rank node, 

among node -corresponding values NVi (1 = 2, 3, 2N-1) for 
respective nodes 1 to which node numbers 1 are given from a 
15 higher-rank node in a breadth first order in a binary tree, 
on the basis of the node -corresponding value NV and the 
node-added variables salt held by the self apparatus, by 
applying the following expression 
[Math 17] 

20 NV lll2] = (NV , 2 © H sa "'(l)) mod M 

where H is a function for mapping an input of any size 
into a size | M | of a product M of the said two large primes, 
and H saltl (1) represents a value obtained by applying the 
function H to 1 as many as salti times. 

25 

32. A decryption processing apparatus for executing 
processing for decrypting cipher texts encrypted with subset 
keys respectively corresponding to subsets set on the basis 
of a SD (Subset Difference) scheme which is a Broadcast 

30 Encryption scheme based on a hierarchical tree configuration, 
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the decryption processing apparatus characterized by 
comprising : 

a cipher text selecting means for selecting a cipher 
text generated by applying a subset key derivable by 
5 pseudo- random number generating processing based on a label 
held by a self apparatus, or a label calculable on the basis 
of a node -corresponding value NV as an intermediate label, 
and node-added variables salt held by the self apparatus, 
from the cipher texts; 
10 a label calculating means for calculating a label 

corresponding to a special subset by executing computational 
processing based on the node -corresponding value NV and the 
node-added variables salt, if the subset key to be applied 
to the cipher text is underivable by the pseudo-random number 
15 generating processing based on the label held; 

a means for generating the subset key by the 
pseudo- random number generating processing based on the 
label held or the label calculated; and 

a decrypting means for executing processing for 
2 0 decrypting the cipher text by applying the generated subset 
key, and 

wherein the label calculating means is configured to 
execute processing for calculating node-corresponding 
values in a path from a self node to a root being a 
2 5 highest -rank node, among node -corresponding values NVi (1 = 

2, 3, 2N-1) for respective nodes 1 to which node numbers 

1 are given from a higher-rank node in a breadth first order 
in a binary tree, on the basis of the node -corresponding value 
NV and the node-added variables salt held by the self 
30 apparatus, by applying the following expression 

[Math 18] 
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NV L//2J = ( NV i 2 ® H sab ' (O) mod M 

where H is a function for mapping an input of any size 
into a size | M | of a product M of the said two large primes, 
and H saltl (1) represents a value obtained by applying the 
5 function H to 1 as many as salti times. 

33. A computer program for generating a hierarchical tree 
which is applied to processing for supplying cipher texts 
decryptable only by certain selected equipment except 

10 excluded (revoked) equipment, by applying a Broadcast 

Encryption scheme based on a hierarchical tree configuration, 
the computer program characterized by comprising: 

a one-way tree generating step of generating a one-way 
tree in which node-corresponding values are set to respective 

15 nodes, the node -corresponding values being set such that a 
node -corresponding value NV a corresponding to each of the 
nodes constituting the hierarchical tree is calculable by 
application of a function f based on a node -corresponding 
value NV b and a node-added variable salt b set so as to 

2 0 correspond to at least one lower- rank node; 

a node key calculating step of calculating node keys NK 
corresponding to the respective nodes constituting the 
one-way tree, by application of a function He using the 
node -corresponding values NV corresponding to the respective 

2 5 nodes as inputs; and 

an information- for- supply determining step of 
selecting a minimum node -corresponding value and node-added 
variables required to calculate node -corresponding values 
included in a path from a receiver-corresponding node to a 

30 root as a highest-rank node, as information to be supplied 
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to a receiver corresponding to a terminal node of the one-way 
tree . 

34 . A computer program for executing processing for 
5 decrypting cipher texts encrypted with node keys 
respectively corresponding to nodes constituting a 
hierarchical tree, by applying a Broadcast Encryption scheme 
based on a hierarchical tree configuration, the computer 
program characterized by comprising: 

10 a cipher text selecting step of selecting a cipher text 

to which a node key generable on the basis of 
node -corresponding values NV and node-added variables salt 
held by a self apparatus, from the cipher texts; 

a node key calculating step of calculating a node key 

15 applied to the cipher text on the basis of the 

node-corresponding values NV and node-added variables salt 
held by the self apparatus; and 

a decrypting step of executing processing for 
decrypting the cipher text on the basis of the calculated node 

2 0 key. 



